Microsoft Word 'sprmCMajority' Record Parsing Remote Code Execution Vulnerability

Bugtraq ID:	42136
Class:	Unknown
CVE:	CVE-2010-1900
Remote:	Yes
Local:	No
Published:	Aug 10 2010 12:00AM
Updated:	Sep 13 2010 07:32AM
Credit:	L.W.Z of team509, working with TippingPoint's Zero Day Initiative
Vulnerable:	Microsoft Works 9.0 Microsoft Word 2007 SP2 Microsoft Word 2007 SP1 Microsoft Word 2007 0 Microsoft Word 2003 SP3 Microsoft Word 2003 SP2 + Microsoft Office 2003 SP1 + Microsoft Office 2003 SP1 + Microsoft Office 2003 0 + Microsoft Office 2003 0 Microsoft Word 2003 SP1 + Microsoft Office 2003 SP1 + Microsoft Office 2003 SP1 + Microsoft Office 2003 0 + Microsoft Office 2003 0 Microsoft Word 2002 SP3 Microsoft Word 2002 SP2 + Microsoft Office XP SP2 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home SP1 - Microsoft Windows XP Home - Microsoft Windows XP Professional SP1 - Microsoft Windows XP Professional Microsoft Word 2002 SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Terminal Server 4.0 SP6 - Microsoft Windows NT Terminal Server 4.0 SP5 - Microsoft Windows NT Terminal Server 4.0 SP4 - Microsoft Windows NT Terminal Server 4.0 SP3 - Microsoft Windows NT Terminal Server 4.0 SP2 - Microsoft Windows NT Terminal Server 4.0 SP1 - Microsoft Windows NT Terminal Server 4.0 alpha - Microsoft Windows NT Terminal Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional Microsoft Open XML File Format Converter for Mac 0 Microsoft Office Compatibility Pack 2007 SP2 Microsoft Office Compatibility Pack 2007 SP1 Microsoft Office Compatibility Pack 2007 0 Microsoft Office 2008 for Mac 0 Microsoft Office 2004 for Mac 0
Not Vulnerable:

Microsoft Word 'sprmCMajority' Record Parsing Remote Code Execution Vulnerability

Microsoft Word is prone to a remote code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions.

Microsoft Word 'sprmCMajority' Record Parsing Remote Code Execution Vulnerability

A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following exploit code is available:

• /data/vulnerabilities/exploits/42136.zip

Microsoft Word 'sprmCMajority' Record Parsing Remote Code Execution Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the referenced advisory for details.


Microsoft Office 2008 for Mac 0

• Microsoft Microsoft Office 2008 for Mac 12.2.6 Update
  http://www.microsoft.com/downloads/details.aspx?FamilyID=6ece112f-0ca7 -4b1f-ad20-603950edee66

Microsoft Works 9.0

• Microsoft Security Update for Microsoft Works 9 (KB2092914)
  http://www.microsoft.com/downloads/details.aspx?familyid=feb121ad-e5f6 -40e2-bf12-045ae5c2a754

Microsoft Office Compatibility Pack 2007 SP2

• Microsoft Security Update for the 2007 Microsoft Office System (KB2277947)
  http://www.microsoft.com/downloads/details.aspx?familyid=ed5b9671-651d -41f3-aed3-93ee8a28657f

Microsoft Word 2003 SP3

• Microsoft Security Update for Microsoft Office Word 2003 (KB2251399)
  http://www.microsoft.com/downloads/details.aspx?familyid=4360bcec-0731 -4d4a-89eb-7d28a4607f06

Microsoft Open XML File Format Converter for Mac 0

• Microsoft Open XML File Format Converter for Mac 1.1.6
  http://www.microsoft.com/downloads/details.aspx?FamilyID=a7b834a3-5a44 -42d4-afe9-6ef207333834

Microsoft Word 2007 SP2

• Microsoft Security Update for Microsoft Office Word 2007 (KB2251419)
  http://www.microsoft.com/downloads/details.aspx?familyid=0d7210a3-662e -41e7-affc-ae94f9d89388

Microsoft Office 2004 for Mac 0

• Microsoft Microsoft Office 2004 for Mac 11.6.0 Update
  http://www.microsoft.com/downloads/details.aspx?FamilyID=d2f44d4a-7cd8 -4514-b3ff-1770bc47d595

Microsoft Word 2002 SP3

• Microsoft Security Update for Microsoft Word 2002 (KB2251389)
  http://www.microsoft.com/downloads/details.aspx?familyid=978eb887-25b6 -4dde-a2ec-d2d1e7f1a434

Microsoft Word 'sprmCMajority' Record Parsing Remote Code Execution Vulnerability

References:

• Microsoft Word Homepage (Microsoft )
  
• ZDI-10-150: Microsoft Office Word sprmCMajority Record Parsing Remote Code Execu (Zero Day Initiaitve)
  
• Microsoft Security Bulletin MS10-056 (Microsoft)
  
• MOAUB#11 �?? Microsoft Office Word sprmCMajority buffer overflow (Abysssec Research)